Kaseya patches platform vulnerability

Customers receive automatic patch.

Kaseya has patched a hole in its managed service offering disclosed at the Kiwicon event over the weekend.

The company worked quickly to fix the hole and had a patch ready hours after being notified by SC about the then zero-day flaw.

An automatic hotfix capability in the platform meant users who had the default updating service active would be protected.

"Each system checks for new hotfixes every 24 hours. So our partners don't have to do anything except enable it," President Mark Sutherland told SC.

In the demonstration, the security researcher created an administrator account on Kaseya by injecting malicious script into a registry key used by the Kaseya user agent. This was accepted by the Managed Service Provider due to a now patched vulnerability in which it failed to properly validate its database.

Take part in discussions with comments on blogs, news and reviews; receive all the latest industry news directly to your inbox and tailor make your information specifically to your interests. Join now for free.

Please check your email

A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.

If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.